PT-2014-2895 · Symantec · Symantec Protection Center Small Business Edition+1

Stefan Viehbock · Published 2014-02-14 · Updated 2014-03-26 · CVE-2013-5014

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection Manager versions 11.0 through 11.0.7405.1424 Symantec Endpoint Protection Manager versions 12.1 through 12.1.4023.4080 Symantec Protection Center Small Business Edition versions 12.x through 12.1.4023.4080

Description The issue allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. This occurs in the management console of the affected software.

Recommendations For Symantec Endpoint Protection Manager versions 11.0 through 11.0.7405.1424, update to version 11.0.7405.1424 or later. For Symantec Endpoint Protection Manager versions 12.1 through 12.1.4023.4080, update to version 12.1.4023.4080 or later. For Symantec Protection Center Small Business Edition versions 12.x through 12.1.4023.4080, update to version 12.1.4023.4080 or later.

Exploit

Fix

Related Identifiers

CVE-2013-5014

Affected Products

Symantec Endpoint Protection Manager

Symantec Protection Center Small Business Edition

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/antivirus/symantec_endpoint_manager_rce.rb · Exploit
• 🔥 http://exploit-db.com/exploits/31853 · Exploit
• 🔥 https://exploit-db.com/exploits/31853 · Exploit
• 🔥 https://exploit-db.com/exploits/31917 · Exploit
• 🔥 http://exploit-db.com/exploits/31917 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-5014 · Security Note
• http://symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140213_00 · Vendor Advisory
• http://securityfocus.com/bid/65466 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5014 · Note
• https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt · Note